In any user interaction with a remote computer system over a network, it is important to verify the identity of the user. Conventionally, this is done with a user name and password, but these can often be intercepted or guessed. Greater security can be provided by means of a cryptographic token that generates a one-time password in response to local entry of the user's password. However, this still requires the user to remember the password. Typically, different tokens and/or passwords are required for different services, which is inconvenient or confusing to the user.
Furthermore, online user authentication can only be as secure as the initial process used to verify the user's identity. If a user fraudulently assumes the identity of another person and thereby obtains a secure online identity, online user authentication does not help to prevent the initial fraudulent identification.
Online transactions require varying degrees of user authentication, which are often a balance between security and convenience. For example, a social networking site may only require a user name and password, but an online banking service may additionally require a cryptographic token and/or further passwords to perform specific actions, such as a transfer of funds. Again, this is inconvenient or confusing for a user.
The Open ID protocol provides an open, decentralised standard for user authentication that allows a user to log in once and gain access to multiple systems. Open ID may be used in conjunction with secure tokens, biometrics or passwords. However, Open ID does not provide means to verify the identity of a user applying for an Open ID identity.
WO 2008/060725 (Franchi) discloses the combined use of a secure token and biometric information in a secure transaction system.
US 2009/0171836 (eBay) discloses an authentication method in which a payment provider compares an image of the user from the merchant system with a known good image of the user, which may be taken by a webcam at the time of online checkout and provided to the merchant. The payment provider system may provide an authentication service for other business in various transactions.
WO 2009/114020 (SGL Network) discloses biometric authentication of a fund transfer by comparing biometric data with a template. Weaker authentication, without biometric information, is allowed if the amount of money transferred is low. Biometric information can include facial recognition. Biometric authentication can be provided as a service to a third party.
US 2004/0151347 (Wisniewski) discloses a token with a chip or bar code, which may be used as a self-authenticating travel document, using facial recognition. The token can be used for granting access to electronic transactions, personal records etc.
WO 2006/019752 (Friendster) discloses a method of authentication by social network scoring.